00. Who's Behind the Conficker Botnet? - An OSINT Analysis 
It used to be a moment in time when the infamous Conficker worm was making the headlines 


with a massive and widespread malware serving campaign that actually propagated to the point 
where it reached a huge portion of Internet connected infrastructure. 
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Who's behind the Conficker worm? 


We've decided to use sample Conficker C&C (Command and Control) domain data courtesy of 
Microsoft (https://msrc-blog.microsoft.com/2009/02/12/conficker-domain-information/) which 
basically consists of approximately 113,500 known Conficker C&C domains and decided to run 
it against WhoisXML API's in-depth and comprehensive real-time and historical WHOIS 
database possibly looking for clues as to the true origins of the Conficker authors in terms of 
offering the security industry actionable intelligence for the purpose of assisting the security 
industry with real-time and historical cyber attack attribution data and information using 
WhoisXML APT's vast real-time and historical WHOIS database. 


In this article and case study we'll offer actionable intelligence on some of the domain 
registrants that are known to have registerested well known and publicly distributed Conficker 
C&C (Command and Control) domains for the purpose of offering actionable intelligence on the 
whereabouts of the botnet masters behind the Conficker botnet. 


It appears that based on the data that we've gathered and processed the majority of domain 
registrant emails used to register a Conficker C&C (Command and Control) server domains 
appears to be exclusively in China and are currently using well known Chinese email service 
providers and on the majority of occasions to be either automatically registered or compromised 
email service accounts. 


Related domain registrant email addresses which are known to have registered Conficker 
related C&C (Command and Control) server domains: 
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594348365@qq[.]com 
287222535@qaq[.Jcom 
827747178@qq[.]com 
3464328814@qq[.]com 
3022240756@qq[.]com 
362533970@qq[.]com 
283302769@qaq[.Jcom 
3062202229@qq[.]com 
162157999@qa[.Jcom 
994969724 @qq[.]com 
3051700539@qq[.]com 
438943379@qaq[.]Jcom 
18888@qq[.]Jcom 
304739080@qq[.]com 
1184461083@qq[.]com 
1353541032@qq[.]Jcom 
XXXXXXXXXXX25x@aqq[.]Jcom 
536449905@qq[.]com 
573550389@qq[.]com 
8567525@qaq[.]com 
435093967 @qaq[.Jcom 
201385824 @qq[.]Jcom 
873785694 @qq[.]com 
3554224479@qq[.]com 
28857 @qaq[.]Jcom 
netbear2010@qq[.]Jcom 
1870010156@qq[.Jcom 
757037911@qq[.]Jcom 
1473338322@qq[.]Jcom 
1822909875@qq[.]Jcom 
991781956@qq[.]com 
997073999@qq[.]com 
820635868 @qaq[.]com 
38559@qq[.]com 
1074898026@qqg[.]com 
123199429@qaq[.Jcom 
610517462@qq[.]com 
4327048@qaq[.Jcom 
185437374@qaq[.Jcom 
1294039509@qq[.]Jcom 
51238888@qq[.]com 


114aomen@gmail[.Jcom 
jinfang914@gmaill.Jcom 
Izmarco0511@gmail[.]Jcom 
itlabsbahrain@gmail[.Jcom 
santosh[.]varughese@gmail[.Jcom 
kandonno1@gmaill.Jcom 
0063car\jie@gmaill.Jcom 
rsseuss@gmaill[.]Jcom 
planmaster@gmail[.]Jcom 
wangxiaomi810@gmaill.Jcom 
oyt1411429@gmail[.Jcom 
wangj5056@gmail[.Jcom 
wuqqyong520@gmail[.}Jcom 
mkiehm17@gmail[.Jcom 
linkregist@gmail[.]Jcom 
wangnimaOyouyaoqi@gmaill.]Jcom 
seozona007@gmail[.Jcom 
yasanharn@gmail[.]Jcom 
66833c2@gmail[.Jcom 
yuhaoyv233@gmail[.Jcom 
alastair[.]t[.]gordon@gmail[.Jcom 
jwbppggr@gmail[.]Jcom 
wangt5257 @gmail[.]Jcom 
gyon166@gmail[.Jcom 
pr[.Jwillmori@gmail[.Jcom 
jochsberger@gmaill[.]com 
guge201788@gmaill.Jcom 
sxok888@gmaill.]Jcom 
Zenphotos@gmaill.]com 
munnashareef5@gmail[.]com 
ucccode@gmaill[.]com 
domainll1122@gmail[.]com 
suxueying6688@gmail[.Jcom 
jacobsthabsile@gmaill[.]com 
wang20170427a@gmail[.Jcom 
annejoan888@gmail[.}Jcom 
1and1fraud779@gmail[.]Jcom 
kedelrec@gmail[.Jcom 
LieRenSEO@gmail[.Jcom 
jinhuihuang888@gmail[.]Jcom 
burn1n9x@gmail[.]Jcom 
freedomaing@gmail[.Jcom 
omosuwafax@gmail[.]Jcom 


nudyma@gmail[.Jcom 
mielawadi@gmail[.]Jcom 
alpineinternetllc@gmail[.Jcom 
fmihaies@gmaill.Jcom 
xvid777@gmail[.]Jcom 
chance2158@gmail[.Jcom 
domain[.]standerd2010@gmail[.Jcom 
zilinglong123@gmaill.Jcom 
wudi789456@gmail[.]Jcom 
3658780@gmail[.]Jcom 
yim65598@gmail[.]com 
ymb8&686@gmail[.Jcom 
yifucaicep@gmail[.Jcom 
oodrohms@gmaill[.Jcom 
qq5598003@gmail[.]Jcom 
tiany5789@gmaill.Jcom 
lokeshcsenita@gmail[.]Jcom 
privacyprotectionabuse@gmail[.]com 
tuljo[.Jrandmaa@gmail[.Jcom 
whjtoby@gmail[.Jcom 
shanmu2002@gmaill.Jcom 
wexiangcheng@gmail[.Jcom 
qq2351093518@gmail[.Jcom 
ofsnqhoq@gmail[.]com 
cai8vip888@gmail[.}Jcom 
fifw365@gmail[.]Jcom 
duandabner@gmail[.Jcom 
chikot3@gmail[.Jcom 
paulataylor9578@gmail[.Jcom 
zhangfei456sss@gmaill.Jcom 
leduhu@gmail[.Jcom 
xing014@gmail[.]Jcom 
whtlzj21@gmaill.Jcom 
bpiajamaica@gmail[.]com 
siteadreslerim@gmail[.Jcom 
fc3398@gmail[.]Jcom 
babyaiki@gmail[.Jcom 
ririaiav@gmail[.Jcom 
deepseawater@gmail[.Jcom 
zuolixue@gmaill.Jcom 
fse0321@gmaill.Jcom 
jgkelly72@gmail[.]Jcom 
liubbang19561@gmail[.}Jcom 
domainslimitada@gmail[.]Jcom 


inealthbuzz@gmail[.Jcom 
linai1809@gmail[.]Jcom 
eoqjaqhp@gmail[.Jcom 
yuchengdong781@gmail[.]Jcom 
coredatatree@gmail[.Jcom 
robvelker@gmail[.Jcom 
amareshombal@gmaill.]Jcom 
jenbradley22@gmail[.]Jcom 
ganxiaojun2015@gmail[.Jcom 
chlytwO08@gmail[.Jcom 
nigelthom@gmail[.Jcom 
tsai81999@gmaill.]Jcom 
somaeel@gmail[.]Jcom 
jyo8545@gmail[.Jcom 
tabuk[.]org@gmail[.]com 
pamjeffords@gmail[.]Jcom 
xlh37785@gmail[.Jcom 
queqingquan10086@gmail[.]com 
bluetea@gmaill[.]com 
tanrongjianS5689@gmail[.Jcom 
neery[.Jorg@gmail[.Jcom 
wjie37881@gmail[.]com 
lishaoxuan8729@gmail[.]Jcom 
thelawyer247@gmail[.]com 
pauldavid[.]Jsong@gmail[.Jcom 
mpsinghchopra@gmail[.Jcom 
mawidc@gmaill.Jcom 
penpenrink@gmaill.Jcom 
vja[.Jnyc@gmaill.Jcom 
lbw32lbw@gmail[.]com 
heroglu4@gmaill.Jcom 
dfewsfe@gmaill.Jcom 
oqufqlib@gmail[.Jcom 
khairul[.]hakims@gmail[.]com 
wqhzh88@gmail[.Jcom 
cityoftruth[.Japostolic@gmail[.Jcom 
punna111@gmail[.Jcom 
kasamoahboateng@gmail[.Jcom 
maigan1182@gmail[.Jcom 
Qhao666@gmail[.]Jcom 
jing582734@gmail[.Jcom 
jamesf[.]nickles@gmail[.Jcom 
boyitang888@gmail[.Jcom 
hashida[.]grannet@gmail[.]Jcom 


janeverno@gmail[.]Jcom 
lif794273@gmail[.]Jcom 
rogbarnard@gmail[.Jcom 
gaoddaw@gmaill[.]Jcom 
ydd9907@gmail[.Jcom 
ideeinfo@gmaill.]Jcom 
ivanstmik@gmail[.Jcom 
qinze113@gmail[.]Jcom 
91888alex@gmail[.]Jcom 
dbghosh@gmail[.Jcom 
prducker@gmail[.]Jcom 
zhanzhang501@gmail[.Jcom 
hasan[.Jnazmul25@gmail[.]Jcom 
majoreye@gmail[.]Jcom 
parascamihai@gmaill.]Jcom 
samirnet2@gmail[.]Jcom 
yakubiakob21@gmail[.]Jcom 
a2zpay[.]biz@gmail[.Jcom 
gzseoxin@gmaill.Jcom 
dmichellemurray@gmail[.]Jcom 
nezbeda@gmaill.Jcom 
biofreez@gmaill.Jcom 
pdinfah[. Jofficial@gmail[.Jcom 
carverd086@gmail[.]Jcom 
pk700755@gmaill[.Jcom 
xudinghua1997@gmail[.]Jcom 
gd555bbb@gmaill.Jcom 
rscp666@gmaill.]Jcom 
patricia[.]nan[.]Janderson@gmail[.Jcom 
fdragon128@gmaill.Jcom 
mahmoodeslami68@gmail[.]Jcom 
oemlklcc@gmail[.Jcom 
Pythagorasfze@gmail[.Jcom 
lebet888@gmaill.Jcom 
vtwfkshp@gmail[.Jcom 
gregmacpherson1@gmail[.Jcom 
mystar0928@gmail[.]com 
sneaky888@gmaill.]Jcom 
xpj09166@gmaill.Jcom 
ziaamail@gmail[.]com 
washa101101@gmail[.Jcom 
launchcyofz@gmail[.]Jcom 
wipoeukn@gmail[.]Jcom 
Allenfra28@gmail[.]com 


cuanqqvg@gmaill.Jcom 
skytams@gmail[.]Jcom 
gds[.]davissr@gmail[.]com 
feidao666@gmail[.]Jcom 
229999@gmaill[.Jcom 
digzby@gmail[.Jcom 
zxsatacrecoold1933@gmail[.]com 
gaogao1788@gmaill.Jcom 
yw97867 1888@gmail[.}Jcom 
ivcarlson2019@gmaill.Jcom 
qxw128188@gmail[.]Jcom 
ipcameramidi@gmaill.Jcom 
helaowang@gmaill.Jcom 
preenand@gmail[.Jcom 
festevaluna1@gmail[.Jcom 
linkhi2016@gmail[.Jcom 
Igson[.]info@gmail[.]com 
Imang4716@gmaill.Jcom 
imlinoc@gmail[.Jcom 
cezar[.]mauro@gmail[.]Jcom 
imuzilee@gmail[.]Jcom 
taode1888@gmaill.]com 
cance0311@gmail[.Jcom 
trackzone28@gmaill.Jcom 
mtc90010@gmail[.Jcom 
rnbeventsservices@gmaill[.]com 
gotowdhs@gmail[.Jcom 
OO2vvwwwwvwv@gmaill[.Jcom 
cp111vip@gmail[.Jcom 
yu79898@gmail[.Jcom 
recording[.]swe[.Jufl@gmail[.Jcom 
tomisinsaheed@gmail[.Jcom 
kerri0dym@gmaill.Jcom 
huaimi888@gmail[.Jcom 
kskhdfd374kjskdhjd@gmaill.Jcom 
mymy2028@gmail[.Jcom 
robert[. }faulkner@gmail[.]Jcom 
ahmedrirash@gmail[.Jcom 
xuexivip@gmaill.]com 
yh52852899@gmail[.Jcom 
cg998000@gmail[.Jcom 
domainveggies@gmail[.Jcom 
bpmfdtnigkhj@gmail[.Jcom 
htyx8888@gmail[.Jcom 


ailaohuyouwahaha1818@gmail[.]Jcom 
wikiwikintn@gmail[.Jcom 
pigos4@gmail[.Jcom 
hfg223344@gmaill.Jcom 
hfg222233@gmaill.Jcom 
youh555888@gmail[.Jcom 
sachacleary810@gmail[.Jcom 
mtc90005@gmaill[.Jcom 
obm14988@gmail[.]Jcom 
hkmyhkhg@gmail[.Jcom 
dw888568@gmaill[.Jcom 
trenb1@gmaill.Jcom 
gianwang00005@gmaill.]Jcom 
domadiyabrijesh@gmail[.Jcom 
xiongbarry888@gmail[.Jcom 
rscp888@gmaill.]com 
kaylamariejwmrfur@gmail[.Jcom 
hfg227788@gmaill.Jcom 
baoma123654@gmail[.]Jcom 
quangads[.]com@gmail[.]Jcom 
edwin[.]Jmysogland@gmail[.Jcom 
ira[.Jbarres@gmail[.Jcom 
zdf123mutouren@gmail[.]Jcom 
zjwo18@gmail[.]Jcom 
ktryener@gmail[.]Jcom 
omidk127@gmaill.]Jcom 
oyodomains@gmaill.]Jcom 
mansuri[.]bitech@gmail[.]com 
9hao168@gmail[.]Jcom 


Tlmasep@yahoo[.]Jcom 
mminerjobs@yahoo[.]com 
archimedessapitula@yahoo[.]Jcom 
exwu@yahoof[.]com 
xavieramo@yahoo[.]com 
eicccsk@yahoo[.]com 
h_azizian_366@yahoo[.]com 
goldenwzw@yahoo[.]com 
drleeherman@yahoo[.]com 
murthy18@yahoo[.]Jcom 
rgmadenforc@yahoo[.]com 
Petrounioungome@yahoo[.]Jcom 
kinnagideghy@yahoo[.]com 
1i2384826402@yahoo][.]com 


erixair@yahoo[.]com 
manishsng12@yahoo[.]com 
linhongyu380@yahoo[.]Jcom 
josephpjohn@yahoo[.]com 
apple4407@yahoo[.]com 
horihan94@yahoo[.]com[.]cn 
seemtruth@yahoo[.]Jcom 
dhairya[.]cholera@yahoo[.]Jcom 
stwministries@yahoo[.]com 
rajeevdua09@yahoo[.]com 
shibu_iiuc@yahoo[.]Jcom 
raini_322@yahoo[.]Jcom 
mzimmardi@yahoo[.]com 


mrsleona[.]Melissia3354@hotmail[.Jcom 
ajbehavioralhealth@hotmail[.Jcom 
LB_Silver@hotmail[.]com 
standpatgxnmabl@hotmail[.]Jcom 
qiao11112016@hotmail[.]Jcom 
arrgnanni@hotmail[.]Jcom 
tamplinvollqtvdt@hotmail[.Jcom 
brave_leng@hotmail[.Jcom 
hexia2017@hotmail[.Jcom 
satyanurak@hotmail[.]com 
ntirlyzhuk@hotmail[.Jcom 
serkankose77/@hotmail[.]com 
detheaseseesl@hotmail[.Jcom 
Sarahodde@hotmail[.]com 
hoganhu@hotmail[.]Jcom 
karrelsxxdusti78@hotmail[.]com 
mohsen|[.Jabbaci@hotmail[.]com 
ttyrey@hotmail[.Jcom 
glc20200410ph@hotmail[.]Jcom 
indelicatoqkkcmt@hotmail[.Jcom 
Zhangqiuyun88@hotmail[.Jcom 
ravz28@hotmail[.Jcom 
cbaldwin256@hotmail[.Jcom 
Eil@hotmail[.Jcom[.]hk 
ahawashi@hotmail[.]Jcom 
maximisddfssel@hotmail[.Jcom 
gs278@hotmail[.]Jcom 
turkialnemr@hotmail[.]Jcom 
sphamma@hotmail[.]Jcom 
kocadagesat@hotmail[.]Jcom 


Related domains known to have been registered by the same domain registrants who 
registered well known and publicly distributed Conficker C&C (Command and Control) 
domains: 


8131688[.]cc 
8132288[.]cc 
8155188[.]cc 
8156688[.]cc 
8158188[.]cc 
8166588[.]cc 
8138288[.]cc 
sscjhq[.]cc 
8129688[.]cc 
yzxsh[.]com[.Jcn 
Isjnh[.Jon 
yzlft[.Jon 
yzdmh[.]com[.]Jcn 
sscptczjgb[.Jcc 
sscjhwyb[.]cc 
sscptpm[.]cc 
evtmh[.]Jcom 
vhwyk[.]com 
fourann[.Jcom 
mhanti[.Jcom 
xivsdo[.]Jcom 
huodmx[.]Jcom 
Iqchri[.]Jcom 
homeyxm[.]Jcom 
mxhty[.]com 
mkcty[.Jcom 
mhtyx[.]com 
gamecty[.]com 
canface[.]cn 
critunes[.Jcn 
pcwer[.]cn 
flywatch[.Jcn 
applecaer[.]cn 
findap[.]cn 
imesg[.]cn 
xltunes[.]cn 
fiyflnd[.Jcn 
flyfind[.Jcn 
itunes-pc[.]cn 


lositunes[.Jcn 
400572[.]cn 
400592].]cn 
800301[.]cn 
80031 9[.Jcn 
800305[.]cn 
400939[.]cn 
800383[.Jcn 
400529[.]cn 
400930[.]cn 
400586[.]cn 
800291[.]cn 
800303[.Jcn 
jmysz[.]com 
jmyfs[.]Jcom 
rjhn[.Jcom 
rmkg[.]Jcom 
rqdg[.]Jcom 
rmxm[.]com 
tdfr[.Jcom 
tqpc[.]Jcom 
tmpy[.]Jcom 
hwrq[.]Jcom 
nyqf[.Jcom 
nkts[.]com 
pcfh[.Jcom 
prxc[.Jcom 
Isjnh[.Jcom[.Jcn 
yzlft[.Jcom[.Jcn 
yzshj[.]net[.Jcn 
yzlft[.Jnet[.Jon 
yzdmh[.]net[.Jcon 
Isjnh[.Jnet[.Jcon 
Isshj[.Jnet[.Jon 
yzysh[.Jcn 
xny123[.Jcom 
gushiduo[.]Jcom 
58yuanlin[.Jcom 
xiangzailai[.]Jcom 
gaokao114[.]com 
fctex[.]Jcom 
f21688[.]com 
52yeyou|[.]com 
shouyouyun[.]Jcom 


yg119[.Jcom 
kuxixi[.]Jcom 
yumi365[.]com 
322593[.]Jcom 
ncoot[.]com 
fatkg[.]Jcom 
iougo[.]com 
megfy[.]Jcom 
memxi[.]com 
meyhe[.Jcom 
32261 3[.]Jcom 
322619[.]Jcom 
981591[.]Jcom 
zbhlw[.]com 
526831[.]Jcom 
628593[.]Jcom 
637853[.]Jcom 
15981 2[.]com 
239616[.Jcom 
311932[.]Jcom 
322615[.]Jcom 
bgmsc[.]info 
bffym[.Jinfo 
bbmpj[.Jinfo 
bbfqg[.]info 
bfhds[.Jinfo 
bbcraq[.]info 
jmyfs[.]net 
ninvi[.Jcom 
uqn6[.]Jcom 
yeues[.]com 
yykfa[.]Jcom 
bewnd[.]info 
bbbfw{[.]info 
36879[.Jwin 
51587[.Jwin 
37328[.Jwin 
63387[.Jwin 
shipincn[.]net 
xa79[.]Jcom 
Ixduomeiti[.]com 
imnanshi[.]com 
chunzhiya[.]Jcom 
ilaoxu[.Jcom 


ishishang[.]net 
riacn[.Jnet 
810955[.]Jcom 
906955[.]Jcom 
67657[.]vip 
712770[.]Jcom 
726770[.]Jcom 
721770[.]Jcom 
731770[.Jcom 
715770[.Jcom 
751770[.Jcom 
753770[.Jcom 
780955[.]Jcom 
735770[.]Jcom 
epclusaguide[.]Jcom 
ydpd-1[.Jcom 
tianzhushixiong[.]Jcom 
yishengzhang[.]Jcom 
yrsyd[.Jcom 
abtlyd[.Jcom 
bifeinitong[.Jcom 
9198868[.]com 
axtnservice[.]com 
Zpj3[.]Jcom 
Icyrs[.Jcom 
tianzhuyidao[.]com 
fxsuslj[.]xyz 
Irzeauj[.]xyz 
tgqlpgt[.]xyz 
qroneqo[.]xyz 
trwqdzk[.]xyz 
rpwbgbbI. }xyz 
bzaozswJ.]xyz 
cssntdy[.]xyz 
cirwaqyil.]xyz 
flrwuho[. }xyz 
dkndrpoa[.]xyz 
dzwtgull.]xyz 
Infez[.Jcom 
Infct[.]Jcom 
Inhkx[.Jcom 
Inhgh[.Jcom 
Injhx[.Jcom 
Injcd[.Jcom 


Ingsx[.]Jcom 
Injwd[.Jcom 
Infcp[.Jcom 
1041[.]cn 
379zuche[.]Jcom 
267 1[.Jcn 
9666[.]net 
Ingxt[.]Jcom 
Inggh[.Jcom 
Inkyh[.]Jcom 
8l[.]vc 
922236[.]Jcom 
911165[.]com 
922235[.]Jcom 
911139[.]com 
922216[.]Jcom 
921115[.]com 
xh5[.]com 
xhwx[.]com 
655562[.]com 
911162[.]Jcom 
922239[.]Jcom 
yakfin[.Jorg 
ivixL.Jcom[.]cn 
touguqun[.Jcn 
beixuangu[.]cn 
pefofs[.Jorg 
xaquan({{[.]org 
batfin[.Jxyz 
bat-fin[.]xyz 
bat-financiall.]xyz 
riches[.]net[.Jcn 
auquant[.Jcom 
wbabs[.]com 
bjlcxsy[.Jcom 
cqtingdal[.]com 
duttopr[.Jcom 
ingmarlee[.Jcom 
apphipmom[.]Jcom 
yagooft[.]com 
jxqszs[.]Jcom 
sitecolect[.Jcom 
wsmisports[.]com 
deboemell[.]com 


edmvs[.]com 
walentyna[.Jcom 
px9qO[.Jcn 
qg6gu[.]cn 
szhzxnz[.]cn 
tduorlt[.Jen 
zabtkyv[.Jcn 
boyqafy[.Jen 
7rj2vi.Jon 
bwalnwx[.]cn 
houibwd[.Jcn 
ht281[.Jcn 
mphxin[.]cn 
nzzpowJ[.]cn 
gangaginpinpai[.]Jcom 
banyoucn[.]com[.]cn 
banyoucr[.]cn 
695[.]cn 

wxtxzs[.]on 
hostnewssJ.]cn 
dianshengkameng[.]com 
runshengyuan[.]net 
xiaozhu[.]cx 
chunhuaxiang[.]Jcom 
yaxy[.]on 
mgmjw[.]Jcom 
wmmbw/[.]Jcom 
4tL.Jcx 

youzil[.]cx 

6606[.]cx 

7774[.]cx 

cmtL.]Jcx 

xinlang[.]cx 
tengxun[.]cx 
huojianxia[.Jnet 
xizhibao[.]net 
yijingxiu[.]net 
chongwushichang[.]cn 
yijingxiu[.]Jcom 
kclmq[.Jcom 
ch678al[.Jcom 
bjfhyy[.Jcom 
sjjpw[.Jcom 
dytiantang[.Jcn 


sjjpw[.]Jcom[.Jon 
bjlpw[.Jcn 
yafk[.Jcn 
sjjpw[.Jon 
voyy[.]net 
tiue[.]net 
wwiy[.]net 
5q5q[.]net 
auhu[.]net 
neae[.]net 
mmmé6[.]net 
mmm5[.]net 
qk64[.]Jcom 
zhanlink[.]Jcom 
qeuu[.]net 
vwv4[.]net 
zrwwb[.]com 
nrbwe[.Jcom 
voqvv[.]Jcom 
mbwvi[.Jcom 
kogar[.Jcom 
kxeix[.Jcom 
dx927[.]Jcom 
fqctv[.Jcom 
mshmI[.]Jcom 
pk10011[.Jcom 
thtyx[.]Jcom 
tkgyx[.]Jcom 
iphfr[.Jcom 
frwgx[.]Jcom 
exlfi[.Jcom 
fhgeb[.]Jcom 
ggswe[.]Jcom 
sfdzf[.Jcom 
xcqcm[.]Jcom 
Ihrtc[.Jcom 
tgjyx[.]Jcom 
thjyx[.]Jcom 
tdmyx[.]Jcom 
tdtyx[.Jcom 
mqgcm[.]Jcom 
tdcyx[.]com 
mkqcm[.]com 
sfdyj[-Jcom 


18712[.]Jcn 
rs3[.Jen 
jvai[.Jon 
lyju[.Jon 
kbwd[.]net 
17339[.Jcn 
18693[.Jcn 
17552[.Jcn 
17553[.Jen 
17662[.Jcn 
17665[.]Jcn 
18685[.Jcn 
fwpgy[.Jcom 
wgdhudt4[.]Jcn 
pydnzet5[.]cn 
xiewztt5[.Jcn 
awxqqjni[.Jcn 
pkibiun4[.Jcn 
201 7-zenith-hongkong[.]hk 
8138383[.]cn 
8526198[.]cn 
paulaaashark-tw2013].]hk 
dkpgyhxO[.]cn 
ymgm[.Jcn 
fijnjvm1[.Jon 
que12[.]Jcom 
zzqcb[.]Jcom 
sdjygc[.]Jcom 
xf01[.]net 
zhengyupin[.]cn 
aeico[.]cn 
defengcctv[.]Jcom 
dks9[.]Jcom 
hbyhgnfd[.Jcom 
hngssc[.]Jcom 
sjybs[.]Jcom 
syt123[.]Jcom 
Ai69al[.Jcn 
409b2][.]cn 
toupiao360J.]cn 
8g8qc[.]Jcn 
2y3r4[.Jon 
edhi3[.Jcn 
Idsc[.]net[.Jcn 


f6ge91[.]cn 
3osbr[.]cn 
ztbg[.]com[.]cn 
ztby[.]Jcom[.Jcn 
dmic[.Jcn 
sxjj[-]com[.]cn 
bxxf[.]com[.Jcn 
tfkw[.Jcom[.Jcn 
tghw[.Jcom[.Jcn 
ddad[.]cn 
txpw[.]com[.]cn 
xzyk[.]Jcom[.Jcn 
tkzw[.]Jcom[.Jcn 
zrsb[.]com[.]cn 
vxk6-b1[.]cn 
kih2-b7[.Jcn 
77xianhua[.]com[.Jcon 
smusic[.]Jcom[.]cn 
testest[.]Jcom[.Jcn 
wysbxg[.]com[.]cn 
jyxinhaosuliaof[.]com[.]cn 
wnzzw/[.]com[.Jcn 
interior-lifestyle-china[.]Jcom[.]cn 
tiztky[.]com[.Jcn 
0313ms[.Jcn 
wfb4-k9[.Jcn 
zrbbm[.Jgdn 
ztgbp[.]gdn 
zmsxz[.]gdn 
zrzyq[.Jgdn 
zrhtd[.Jgdn 
zssdn[.Jgdn 
zslijp[.Jgdn 
zpnhy[.Jgdn 
zrndy[.]gdn 
zrmkk[.]gdn 
zshcg[.]Jgdn 
zshxl[.Jgdn 
huashenlu[.]net 
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es05b2h[.]cn 

f8yurfn[.Jon 

octzbqa[.]cn 

hoikz7t[.Jcn 

wbbunodg[.]cn 

wqebs[.]cn 

upfubku[.Jcn 

xhjf4as[.Jon 

wlyj0z1[.]cn 

zsvpcwb[.]cn 

xlgjg[.]net 

avyxpt[.Jcom 

hyhem[.]com 

weidafu[.]net 
tukelang[.]com 

sdsec[.Jorg 

auskene[.]com 
xn--15qr42e1jOa[.]xn--ses554g 
xn--15qr42evwy[.]xn--ses554g 
xn--15qs44a6ogbxh8z5c[.]xn--ses554g 
xn--15qs44a6ogbxhyv2c[.]xn--ses554g 
xn--b9w7 13f[.]xn--ses554g 
xn--b9wp28e[.]xn--ses554g 
sup-abrasives[.]com[.]cn 
gcqzx[.]gov[.Jcn 
jsguanxin[.Jcn 
gxgjxnyhy[.Jcom 
ozyhgj[.Jcom 

ymgchz[.]Jcom 

wklsgj[.Jcom 


guangxigaojin[.]Jcom 
blgjlct[.Jcom 
jiayuan[.Jnet[.Jcon 
stqz[.]cn 
shanghutong[.]cn 
stri[.]Jcom[.Jcn 
eeff[.Jcc 

u6w[.]cn 
taodaixiao[.Jcn 
weichuanbo[.]cn 
ad5w/[.Jon 
adminw[.]cn 
iguangdong[.]cn 
51gongzuo[.}cn 
gz-mazell.]cn 
12g[.]Jcom[.]cn 
sjgjsi[.Jen 
mgpets[.]cn 
sdbpz[.]cn 
ydwt[.]com[.]cn 
qicaihongys[.]cn 
njlrx[.Jon 
qlhjy[-Jen 
hyk-express[.]cn 
jyxnyh[.Jcn 
whwudaopeixun[.]cn 
ymposf[.]net 
pinpaiw[.]net 
hzfxkj[.Jnet 
showzstyle[.]com 
bjyhstqc[.]Jcom 
infreightlog[.]Jcom 
xytjhb[.Jcom 
cndgzq[.]Jcom 
hhshw[.]net 
tisconn[.]net 
hongyujichuang[.]Jcom 
infoyou[.]cn 
huntergatherer[.]cn 
strontium[.Jcn 
sundansf[.]cn 
purecof.]cn 
sugarskull[.]cn 
kubit[.Jcn 


posvip[.]cn 
inmicro[.]cn 
niketraining[.]cn 
tutuai[.]cn 
colorled[.]cn 
tpgb[.]net 
plftL.Jnet 

pkyw [.]net 
pkyc[.]net 
phfq[.]net 
phcb[.]net 
phbz[.]net 
plfw[.Jnet 
tnyt[.]net 
tpfq[.Jnet 
tpfn[.Jnet 
wnqea|[.]Jcom 
ceaqw[.]com 
obwnr[.]com 
fquoh[.]Jcom 
rbytq[.Jcom 
9283828[.]com 
kmcits5766[.]cn 
qngwy[.]Jcom 
uszus[.]com 
ynhqgl[.Jcn 
huanqiuguolv[.Jcn 
usamn[.]com 
ynhq[.]com[.Jcn 
cagwy[.]Jcom 
americauniversal[.]com 
tyxzt[.Jon 
zgshihua[.]cn 
100valve[.Jcn 
linxianwang[.]cn 
com087[.]cn 
cn0198[.Jcn 
cn0196[.]cn 
cn0175[.]cn 
cn0174[.]Jcn 
szxiangnuo[.]cn 
fanyatouzi[.]cn 
8000].]cn 
lenglve[.]Jcom 


datukuaidi[.Jcom 
zsks[.]Jwang 
datongshuai[.Jcom 
Qianjujie[.]Jcom 
juanqimei[.Jcom 
wlxtz[.]Jcom 
cyrx[.]wang 
Ive[.]Jwang 
kanguan[.]wang 
haiguan[.]}wang 
celve[.Jwang 
zwedu[.Jorg[.]cn 
zhongwangroupJ.]Jorg[.Jcn 
diyijobs[.Jcn 
tths360[.]cn 
diyigiye[.Jcn 
diyijiancai[.]net 
zhjichuang[.]Jcom 
emte[.]Jcom[.Jcn 
emte[.]net[.Jcn 
hfhszz[.Jcom[.]cn 
hefeijjw[.Jcn 
tths360[.]com[.]cn 
acqcp[.]Jcom 
nqyzy[.Jcom 
mrvwg[.]com 
nmoav[.]Jcom 
guygz[.]Jcom 
pktda[.Jcom 
hbtku[.Jcom 
onlyclean[.]net 
oitsm[.Jcom 
ctcv3a[.Jcom 
qqtej1688[.]com 
qqmhk[.Jcom 
tbcen[.]Jcom 
2010el[.]com 
qcc2010[.Jcom 
tengxun-qt2010[.]Jcom 
ctcv3h[.]Jcom 
ctcv3k[.]Jcom 
qqbty[.]Jcom 
ctcv3c[.]Jcom 
qakgy[.Jcom 


93295786[.]cn 
97393122[.]cn 
21336588[.]cn 
39938522].]cn 
11788598[.]cn 
88635882][.]cn 
87932521[.]cn 
39757915].Jcn 
38793765[.Jcn 
53238699][.]cn 
25982928]. ]cn 
31852779[.]cn 
xjafm[.Jcom 
zyaap[.]Jcom 
zyabk[.]Jcom 
zyabm[.]Jcom 
xjadm[.]Jcom 
xjafd[.Jcom 
xjagj[.]Jcom 
xmafd[.Jcom 
xmafg[.]Jcom 
zyach[.]Jcom 
zyaao[.]Jcom 
zyaaf[.Jcom 
zhenpi[.Jcn 
shtpw[.Jcom 
shqjw[.]com 
shtqw[.Jcom 
shhpw[.]Jcom 
vrniu[.]Jcom 
chengkun[.]Jcn 
virtualdesktop[.]cn 
zhensi[.Jcn 
aicat[.Jcom 
daocong[.]cn 
banluo[.]cn 
Iccyl[.Jcom 
lifeextension[.]Jcom[.]cn 
lifeextensionretail[.]cn 
lifeextensionretail[.]com[.]cn 
81818888[.]cn 
lalaoxm[.Jcn 
laladqw{[.]cn 
ecoprity[.]com[.Jcn 


wisewin[.]net[.Jcn 
witroad[.]Jcom 
ecoprity[.]net 
hzjyw[.]com[.Jcn 
hzjyapp[.Jcom 
391659[.Jwang 
392119[.Jwang 
681582[.]Jwang 
286637[.]wang 
596726[.]Jwang 
289837[.]wang 
jwhs[.]net 
znjh[.Jnet 
tihqw[.Jcn 
ytjtw[.Jcom 
gzwwwi[.|cn 
62126[.]Jcom[.]cn 
16563][.]net 
65672[.]net 
17876[.]net 
16132[.Jnet 
87582[.]net 
shcpw{.]cn 
alimail[.Jcn 
yitifu[.Jon 
weimeiti[.Jcn 
maichil[.]wang 
hpool[.Jcn 
chouzil[.Jcn 
bitpe[.Jcn 
iapp[.Jcn 
biju[.Jon 
dianshigouwu[.]cn 
moci[.]cn 
vrL.Jtop 
Imflq[.]Jcom 
Imjmp[.]Jcom 
Ikqxq[.Jcom 
Imjqz[.Jcom 
Imkpk[.]Jcom 
Imkwa[.]Jcom 
Immpf[.Jcom 
tietong[.]cc 
Ikqwaq[.]Jcom 


Ikqwp[.]Jcom 
Ikqwm[.]Jcom 
Ikqwk[.]Jcom 
u65j8k8l[.Jcn 
zqaeenih[.]cn 
scblwtbj[.Jcn 
gyuifu688[.Jcn 
tzpbyedo].]cn 
twjdxrmlI[.]cn 
f4h5j5j[.]on 
thbreh6sts[.]cn 
gr4h654j57[.Jcn 
Iqdhs[.Jcn 
dbcgfhdil.]cn 
rxkqhhth[. Jon 
2w4b[.Jcom[.]cn 
186753[.]wang 
392189[.Jwang 
725221[.Jwang 
262817[.Jwang 
262839[.]wang 
286193[.Jwang 
yk888h[.]Jcom 
yk888l[.]Jcom 
yk888i[.Jcom 
7ma2[.Jcn 
yk888f[.]Jcom 
yk888a[.]Jcom 
yk888b[.]Jcom 
yk888c[.]com 
yk888m[.]com 
yk888k[.]com 
yk888d[.]Jcom 
tripadvisorrentals[.Jasia 
zamro[.]jp 
territory[.]jp 
duv[.]wang 
uvf[.Jwang 
rkmy[.Jwang 
55[.]zj[.Jon 
ylcpn[.Jcom 
ylcsa[.]Jcom 
ylcuy[.]com 
totalenergies[.]com[.]tw 


myvitamins[.]tw 
lyst[.Jtw 
almonds[.]tw 
paybit[.]com[.]tw 
fragrancenet[.]com[.]tw 
flipkart[. Jtw 
inlex[.]jp 
symbiosys[.]tw 
usane[.Jcom[.Jcn 
sz-art[.Jcom[.Jcn 
rzxsj[.]Jcom 
$z-jinyang[.Jcn 
szyizhao[.]Jcom[.]cn 
em-china[.]cn 
followe[.Jcn 
szinfocn[.]cn 
$z-mb[.]cn 
probro[.]cn 
probro[.]com[.]cn 
dingyejh[.Jcom 
szmas[.]top 
tzng[.]Jcom[.]cn 
gudongdai[.]wang 
058[.]Jwang 
xymd[.Jcom[.]cn 
xzns[.]com[.]cn 
wqlm[.]com[.]cn 
tznw[.]com[.]cn 
fwsm[.]com[.]cn 


We'll continue monitoring the campaign and post updates as soon as new developments take 
place in particular new Conficker domain registrations in an attempt to track down the true 
botnet masters behind the infamous Conficker botnet. 


